Little Pieces Virus

Virus Name: Little Pieces Aliases: 1374, Pieces V Status: Rare Discovered: January, 1991 Symptoms: .COM & .EXE growth; decrease in available free memory; message; system hangs; unexpected screen clears Origin: Italy Eff Length: 1,374 Bytes Type Code: PRaE - Parasitic Resident .EXE Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected programs General Comments: The Little Pieces virus was isolated in January, 1991, in Italy. This virus is a 1,374 byte memory resident infector of .EXE files. The first time a program infected with Little Pieces is executed, the virus will install itself memory resident. The area where it is memory resident is 1,392 bytes long and labeled COMMAND Data in low system memory. Some memory mapping utilities will combine this area with the command interpreter, so the command interpreter will appear to be 1,392 bytes longer than expected. Interrupts 13, 16, and 21 are hooked by the Little Pieces virus. Once Little Pieces is memory resident, it will infect .EXE programs as they are executed. Infected .EXE programs will increase in size by 1,374 bytes and have the virus located at the end of the infected file. Infected files will not have their date and time in the disk directory altered. Systems infected with the Little Pieces virus may experience the system display being cleared unexpectedly after a key is pressed on the keyboard. The following message is usually displayed after the screen is cleared, though not always: "One of these days I'm going to cut you into little pieces" This message cannot be viewed in infected files as it is encrypted within the virus. Infected system may also experience unexpected system hangs occurring, requiring the system to be rebooted. These hangs sometimes occur after the above message is displayed.